Analysis
- max time kernel
298s - max time network
195s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 20:09
General
- Target RSGl3PFSz.cmd
- Size 1KB
- Sample260804-yw6sdaxtfv
- SHA256 5ea239964133266725136ac3439b8506c32a1912fb497a6bd0c3d096d0385809
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\where.exewhere conhost.exe2⤵
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd" /launched2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\RSGl3PFSz.cmd /launched3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\FluentAssertions.csproj" /nologo /v:q4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5008-0-0x0000020FC4330000-0x0000020FC436E000-memory.dmp
memory/5008-1-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp
memory/5008-3-0x0000020FDEAE0000-0x0000020FDEC3A000-memory.dmp
memory/5008-2-0x0000020FC47E0000-0x0000020FC47FA000-memory.dmp
memory/5008-4-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-5-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-6-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-7-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-8-0x0000020FC6040000-0x0000020FC6070000-memory.dmp
memory/5008-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-13-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-14-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-15-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-17-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-16-0x0000020FC6220000-0x0000020FC629C000-memory.dmp
memory/5008-19-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp
memory/5008-20-0x0000020FDE2C0000-0x0000020FDE5D8000-memory.dmp
memory/5008-21-0x0000020FDED40000-0x0000020FDEDC4000-memory.dmp
memory/5008-24-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp